A vulnerability on Advantech ADAM-3600 devices allows an attacker who is already authenticated to execute code arbitrarily on the service. The flaw can be leveraged to gain control of the device with the privileges of the authenticated session.

The vulnerability affects Advantech ADAM-3600 models. No specific affected versions are disclosed in the available data, which makes it necessary to verify whether your deployment is running a vulnerable configuration.

The CVSS score of 8.6 classifies the issue as high severity. The EPSS score is below 1%, indicating that the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, requiring authentication, so the attacker must first gain valid credentials. Because the impact is full code execution, the risk to confidentiality, integrity, and availability is significant if the flaw is exploited.